To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.709
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.709
- Committer: Teddy Hogeborn
- Date: 2019-08-18 04:14:31 UTC
- mto: This revision was merged to the branch mainline in revision 390.
- Revision ID: teddy@recompile.se-20190818041431-jgt8pizlzjvxalj0
Debian package: Client: Install the systemd sysusers.d file
* debian/mandos-client.dirs (usr/lib/sysusers.d): New.
* debian/mandos-client.dirs (usr/lib/sysusers.d): New.
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
79
80
80
81
import dbus
81
82
import dbus.service
83
import gi
82
84
from gi.repository import GLib
83
85
from dbus.mainloop.glib import DBusGMainLoop
84
86
import ctypes
86
88
import xml.dom.minidom
87
89
import inspect
88
90
91
if sys.version_info.major == 2:
92
__metaclass__ = type
93
89
94
# Try to find the value of SO_BINDTODEVICE:
90
95
try:
91
96
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
114
119
if sys.version_info.major == 2:
115
120
str = unicode
116
121
117
version = "1.7.10"
122
if sys.version_info < (3, 2):
123
configparser.Configparser = configparser.SafeConfigParser
124
125
version = "1.8.7"
118
126
stored_state_file = "clients.pickle"
119
127
120
128
logger = logging.getLogger()
124
132
if_nametoindex = ctypes.cdll.LoadLibrary(
125
133
ctypes.util.find_library("c")).if_nametoindex
126
134
except (OSError, AttributeError):
127
135
128
136
def if_nametoindex(interface):
129
137
"Get an interface index the hard way, i.e. using fcntl()"
130
138
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
153
161
154
162
def initlogger(debug, level=logging.WARNING):
155
163
"""init logger and add loglevel"""
156
164
157
165
global syslogger
158
166
syslogger = (logging.handlers.SysLogHandler(
159
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
160
address = "/dev/log"))
167
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
168
address="/dev/log"))
161
169
syslogger.setFormatter(logging.Formatter
162
170
('Mandos [%(process)d]: %(levelname)s:'
163
171
' %(message)s'))
164
172
logger.addHandler(syslogger)
165
173
166
174
if debug:
167
175
console = logging.StreamHandler()
168
176
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
178
186
pass
179
187
180
188
181
class PGPEngine(object):
189
class PGPEngine:
182
190
"""A simple class for OpenPGP symmetric encryption & decryption"""
183
191
184
192
def __init__(self):
185
193
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
194
self.gpg = "gpg"
201
209
# Only GPG version 1 has the --no-use-agent option.
202
210
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
211
self.gnupgargs.append("--no-use-agent")
204
212
205
213
def __enter__(self):
206
214
return self
207
215
208
216
def __exit__(self, exc_type, exc_value, traceback):
209
217
self._cleanup()
210
218
return False
211
219
212
220
def __del__(self):
213
221
self._cleanup()
214
222
215
223
def _cleanup(self):
216
224
if self.tempdir is not None:
217
225
# Delete contents of tempdir
218
226
for root, dirs, files in os.walk(self.tempdir,
219
topdown = False):
227
topdown=False):
220
228
for filename in files:
221
229
os.remove(os.path.join(root, filename))
222
230
for dirname in dirs:
224
232
# Remove tempdir
225
233
os.rmdir(self.tempdir)
226
234
self.tempdir = None
227
235
228
236
def password_encode(self, password):
229
237
# Passphrase can not be empty and can not contain newlines or
230
238
# NUL bytes. So we prefix it and hex encode it.
235
243
.replace(b"\n", b"\\n")
236
244
.replace(b"\0", b"\\x00"))
237
245
return encoded
238
246
239
247
def encrypt(self, data, password):
240
248
passphrase = self.password_encode(password)
241
249
with tempfile.NamedTemporaryFile(
246
254
'--passphrase-file',
247
255
passfile.name]
248
256
+ self.gnupgargs,
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
257
stdin=subprocess.PIPE,
258
stdout=subprocess.PIPE,
259
stderr=subprocess.PIPE)
260
ciphertext, err = proc.communicate(input=data)
253
261
if proc.returncode != 0:
254
262
raise PGPError(err)
255
263
return ciphertext
256
264
257
265
def decrypt(self, data, password):
258
266
passphrase = self.password_encode(password)
259
267
with tempfile.NamedTemporaryFile(
260
dir = self.tempdir) as passfile:
268
dir=self.tempdir) as passfile:
261
269
passfile.write(passphrase)
262
270
passfile.flush()
263
271
proc = subprocess.Popen([self.gpg, '--decrypt',
264
272
'--passphrase-file',
265
273
passfile.name]
266
274
+ self.gnupgargs,
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
275
stdin=subprocess.PIPE,
276
stdout=subprocess.PIPE,
277
stderr=subprocess.PIPE)
278
decrypted_plaintext, err = proc.communicate(input=data)
271
279
if proc.returncode != 0:
272
280
raise PGPError(err)
273
281
return decrypted_plaintext
274
282
283
275
284
# Pretend that we have an Avahi module
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
285
class avahi:
286
"""This isn't so much a class as it is a module-like namespace."""
287
IF_UNSPEC = -1 # avahi-common/address.h
288
PROTO_UNSPEC = -1 # avahi-common/address.h
289
PROTO_INET = 0 # avahi-common/address.h
290
PROTO_INET6 = 1 # avahi-common/address.h
283
291
DBUS_NAME = "org.freedesktop.Avahi"
284
292
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
285
293
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
286
294
DBUS_PATH_SERVER = "/"
287
def string_array_to_txt_array(self, t):
295
296
@staticmethod
297
def string_array_to_txt_array(t):
288
298
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
289
299
for s in t), signature="ay")
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
300
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
301
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
302
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
303
SERVER_INVALID = 0 # avahi-common/defs.h
304
SERVER_REGISTERING = 1 # avahi-common/defs.h
305
SERVER_RUNNING = 2 # avahi-common/defs.h
306
SERVER_COLLISION = 3 # avahi-common/defs.h
307
SERVER_FAILURE = 4 # avahi-common/defs.h
308
299
309
300
310
class AvahiError(Exception):
301
311
def __init__(self, value, *args, **kwargs):
312
322
pass
313
323
314
324
315
class AvahiService(object):
325
class AvahiService:
316
326
"""An Avahi (Zeroconf) service.
317
327
318
328
Attributes:
319
329
interface: integer; avahi.IF_UNSPEC or an interface index.
320
330
Used to optionally bind to the specified interface.
332
342
server: D-Bus Server
333
343
bus: dbus.SystemBus()
334
344
"""
335
345
336
346
def __init__(self,
337
interface = avahi.IF_UNSPEC,
338
name = None,
339
servicetype = None,
340
port = None,
341
TXT = None,
342
domain = "",
343
host = "",
344
max_renames = 32768,
345
protocol = avahi.PROTO_UNSPEC,
346
bus = None):
347
interface=avahi.IF_UNSPEC,
348
name=None,
349
servicetype=None,
350
port=None,
351
TXT=None,
352
domain="",
353
host="",
354
max_renames=32768,
355
protocol=avahi.PROTO_UNSPEC,
356
bus=None):
347
357
self.interface = interface
348
358
self.name = name
349
359
self.type = servicetype
358
368
self.server = None
359
369
self.bus = bus
360
370
self.entry_group_state_changed_match = None
361
371
362
372
def rename(self, remove=True):
363
373
"""Derived from the Avahi example code"""
364
374
if self.rename_count >= self.max_renames:
384
394
logger.critical("D-Bus Exception", exc_info=error)
385
395
self.cleanup()
386
396
os._exit(1)
387
397
388
398
def remove(self):
389
399
"""Derived from the Avahi example code"""
390
400
if self.entry_group_state_changed_match is not None:
392
402
self.entry_group_state_changed_match = None
393
403
if self.group is not None:
394
404
self.group.Reset()
395
405
396
406
def add(self):
397
407
"""Derived from the Avahi example code"""
398
408
self.remove()
415
425
dbus.UInt16(self.port),
416
426
avahi.string_array_to_txt_array(self.TXT))
417
427
self.group.Commit()
418
428
419
429
def entry_group_state_changed(self, state, error):
420
430
"""Derived from the Avahi example code"""
421
431
logger.debug("Avahi entry group state change: %i", state)
422
432
423
433
if state == avahi.ENTRY_GROUP_ESTABLISHED:
424
434
logger.debug("Zeroconf service established.")
425
435
elif state == avahi.ENTRY_GROUP_COLLISION:
429
439
logger.critical("Avahi: Error in group state changed %s",
430
440
str(error))
431
441
raise AvahiGroupError("State changed: {!s}".format(error))
432
442
433
443
def cleanup(self):
434
444
"""Derived from the Avahi example code"""
435
445
if self.group is not None:
440
450
pass
441
451
self.group = None
442
452
self.remove()
443
453
444
454
def server_state_changed(self, state, error=None):
445
455
"""Derived from the Avahi example code"""
446
456
logger.debug("Avahi server state change: %i", state)
475
485
logger.debug("Unknown state: %r", state)
476
486
else:
477
487
logger.debug("Unknown state: %r: %r", state, error)
478
488
479
489
def activate(self):
480
490
"""Derived from the Avahi example code"""
481
491
if self.server is None:
492
502
class AvahiServiceToSyslog(AvahiService):
493
503
def rename(self, *args, **kwargs):
494
504
"""Add the new name to the syslog messages"""
495
ret = AvahiService.rename(self, *args, **kwargs)
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
496
506
syslogger.setFormatter(logging.Formatter(
497
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
498
508
.format(self.name)))
499
509
return ret
500
510
511
501
512
# Pretend that we have a GnuTLS module
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
513
class gnutls:
514
"""This isn't so much a class as it is a module-like namespace."""
515
516
library = ctypes.util.find_library("gnutls")
517
if library is None:
518
library = ctypes.util.find_library("gnutls-deb0")
519
_library = ctypes.cdll.LoadLibrary(library)
520
del library
521
517
522
# Unless otherwise indicated, the constants and types below are
518
523
# all from the gnutls/gnutls.h C header file.
519
524
520
525
# Constants
521
526
E_SUCCESS = 0
522
527
E_INTERRUPTED = -52
523
528
E_AGAIN = -28
524
529
CRT_OPENPGP = 2
530
CRT_RAWPK = 3
525
531
CLIENT = 2
526
532
SHUT_RDWR = 0
527
533
CRD_CERTIFICATE = 1
528
534
E_NO_CERTIFICATE_FOUND = -49
535
X509_FMT_DER = 0
536
NO_TICKETS = 1<<10
537
ENABLE_RAWPK = 1<<18
538
CTYPE_PEERS = 3
539
KEYID_USE_SHA256 = 1 # gnutls/x509.h
529
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
530
541
531
542
# Types
532
543
class session_int(ctypes.Structure):
533
544
_fields_ = []
534
545
session_t = ctypes.POINTER(session_int)
546
535
547
class certificate_credentials_st(ctypes.Structure):
536
548
_fields_ = []
537
549
certificate_credentials_t = ctypes.POINTER(
538
550
certificate_credentials_st)
539
551
certificate_type_t = ctypes.c_int
552
540
553
class datum_t(ctypes.Structure):
541
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
555
('size', ctypes.c_uint)]
556
543
557
class openpgp_crt_int(ctypes.Structure):
544
558
_fields_ = []
545
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
547
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
548
562
credentials_type_t = ctypes.c_int
549
563
transport_ptr_t = ctypes.c_void_p
550
564
close_request_t = ctypes.c_int
551
565
552
566
# Exceptions
553
567
class Error(Exception):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
568
def __init__(self, message=None, code=None, args=()):
559
569
# Default usage is by a message string, but if a return
560
570
# code is passed, convert it to a string with
561
571
# gnutls.strerror()
562
572
self.code = code
563
573
if message is None and code is not None:
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
574
message = gnutls.strerror(code)
575
return super(gnutls.Error, self).__init__(
566
576
message, *args)
567
577
568
578
class CertificateSecurityError(Error):
569
579
pass
570
580
571
581
# Classes
572
class Credentials(object):
582
class Credentials:
573
583
def __init__(self):
574
584
self._c_object = gnutls.certificate_credentials_t()
575
585
gnutls.certificate_allocate_credentials(
576
586
ctypes.byref(self._c_object))
577
587
self.type = gnutls.CRD_CERTIFICATE
578
588
579
589
def __del__(self):
580
590
gnutls.certificate_free_credentials(self._c_object)
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
591
592
class ClientSession:
593
def __init__(self, socket, credentials=None):
584
594
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
595
gnutls_flags = gnutls.CLIENT
596
if gnutls.check_version(b"3.5.6"):
597
gnutls_flags |= gnutls.NO_TICKETS
598
if gnutls.has_rawpk:
599
gnutls_flags |= gnutls.ENABLE_RAWPK
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
601
del gnutls_flags
586
602
gnutls.set_default_priority(self._c_object)
587
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
604
gnutls.handshake_set_private_extensions(self._c_object,
594
610
ctypes.cast(credentials._c_object,
595
611
ctypes.c_void_p))
596
612
self.credentials = credentials
597
613
598
614
def __del__(self):
599
615
gnutls.deinit(self._c_object)
600
616
601
617
def handshake(self):
602
618
return gnutls.handshake(self._c_object)
603
619
604
620
def send(self, data):
605
621
data = bytes(data)
606
622
data_len = len(data)
608
624
data_len -= gnutls.record_send(self._c_object,
609
625
data[-data_len:],
610
626
data_len)
611
627
612
628
def bye(self):
613
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
614
630
615
631
# Error handling functions
616
632
def _error_code(result):
617
633
"""A function to raise exceptions on errors, suitable
619
635
if result >= 0:
620
636
return result
621
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
638
raise gnutls.CertificateSecurityError(code=result)
639
raise gnutls.Error(code=result)
640
625
641
def _retry_on_error(result, func, arguments):
626
642
"""A function to retry on some errors, suitable
627
643
for the 'errcheck' attribute on ctypes functions"""
630
646
return _error_code(result)
631
647
result = func(*arguments)
632
648
return result
633
649
634
650
# Unless otherwise indicated, the function declarations below are
635
651
# all from the gnutls/gnutls.h C header file.
636
652
637
653
# Functions
638
654
priority_set_direct = _library.gnutls_priority_set_direct
639
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
640
656
ctypes.POINTER(ctypes.c_char_p)]
641
657
priority_set_direct.restype = _error_code
642
658
643
659
init = _library.gnutls_init
644
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
645
661
init.restype = _error_code
646
662
647
663
set_default_priority = _library.gnutls_set_default_priority
648
664
set_default_priority.argtypes = [session_t]
649
665
set_default_priority.restype = _error_code
650
666
651
667
record_send = _library.gnutls_record_send
652
668
record_send.argtypes = [session_t, ctypes.c_void_p,
653
669
ctypes.c_size_t]
654
670
record_send.restype = ctypes.c_ssize_t
655
671
record_send.errcheck = _retry_on_error
656
672
657
673
certificate_allocate_credentials = (
658
674
_library.gnutls_certificate_allocate_credentials)
659
675
certificate_allocate_credentials.argtypes = [
660
676
ctypes.POINTER(certificate_credentials_t)]
661
677
certificate_allocate_credentials.restype = _error_code
662
678
663
679
certificate_free_credentials = (
664
680
_library.gnutls_certificate_free_credentials)
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
666
683
certificate_free_credentials.restype = None
667
684
668
685
handshake_set_private_extensions = (
669
686
_library.gnutls_handshake_set_private_extensions)
670
687
handshake_set_private_extensions.argtypes = [session_t,
671
688
ctypes.c_int]
672
689
handshake_set_private_extensions.restype = None
673
690
674
691
credentials_set = _library.gnutls_credentials_set
675
692
credentials_set.argtypes = [session_t, credentials_type_t,
676
693
ctypes.c_void_p]
677
694
credentials_set.restype = _error_code
678
695
679
696
strerror = _library.gnutls_strerror
680
697
strerror.argtypes = [ctypes.c_int]
681
698
strerror.restype = ctypes.c_char_p
682
699
683
700
certificate_type_get = _library.gnutls_certificate_type_get
684
701
certificate_type_get.argtypes = [session_t]
685
702
certificate_type_get.restype = _error_code
686
703
687
704
certificate_get_peers = _library.gnutls_certificate_get_peers
688
705
certificate_get_peers.argtypes = [session_t,
689
706
ctypes.POINTER(ctypes.c_uint)]
690
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
691
708
692
709
global_set_log_level = _library.gnutls_global_set_log_level
693
710
global_set_log_level.argtypes = [ctypes.c_int]
694
711
global_set_log_level.restype = None
695
712
696
713
global_set_log_function = _library.gnutls_global_set_log_function
697
714
global_set_log_function.argtypes = [log_func]
698
715
global_set_log_function.restype = None
699
716
700
717
deinit = _library.gnutls_deinit
701
718
deinit.argtypes = [session_t]
702
719
deinit.restype = None
703
720
704
721
handshake = _library.gnutls_handshake
705
722
handshake.argtypes = [session_t]
706
723
handshake.restype = _error_code
707
724
handshake.errcheck = _retry_on_error
708
725
709
726
transport_set_ptr = _library.gnutls_transport_set_ptr
710
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
711
728
transport_set_ptr.restype = None
712
729
713
730
bye = _library.gnutls_bye
714
731
bye.argtypes = [session_t, close_request_t]
715
732
bye.restype = _error_code
716
733
bye.errcheck = _retry_on_error
717
734
718
735
check_version = _library.gnutls_check_version
719
736
check_version.argtypes = [ctypes.c_char_p]
720
737
check_version.restype = ctypes.c_char_p
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
738
739
_need_version = b"3.3.0"
740
if check_version(_need_version) is None:
741
raise self.Error("Needs GnuTLS {} or later"
742
.format(_need_version))
743
744
_tls_rawpk_version = b"3.6.6"
745
has_rawpk = bool(check_version(_tls_rawpk_version))
746
747
if has_rawpk:
748
# Types
749
class pubkey_st(ctypes.Structure):
750
_fields = []
751
pubkey_t = ctypes.POINTER(pubkey_st)
752
753
x509_crt_fmt_t = ctypes.c_int
754
755
# All the function declarations below are from gnutls/abstract.h
756
pubkey_init = _library.gnutls_pubkey_init
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
758
pubkey_init.restype = _error_code
759
760
pubkey_import = _library.gnutls_pubkey_import
761
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
762
x509_crt_fmt_t]
763
pubkey_import.restype = _error_code
764
765
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
766
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
767
ctypes.POINTER(ctypes.c_ubyte),
768
ctypes.POINTER(ctypes.c_size_t)]
769
pubkey_get_key_id.restype = _error_code
770
771
pubkey_deinit = _library.gnutls_pubkey_deinit
772
pubkey_deinit.argtypes = [pubkey_t]
773
pubkey_deinit.restype = None
774
else:
775
# All the function declarations below are from gnutls/openpgp.h
776
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
779
openpgp_crt_init.restype = _error_code
780
781
openpgp_crt_import = _library.gnutls_openpgp_crt_import
782
openpgp_crt_import.argtypes = [openpgp_crt_t,
783
ctypes.POINTER(datum_t),
784
openpgp_crt_fmt_t]
785
openpgp_crt_import.restype = _error_code
786
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
790
openpgp_crt_verify_self.restype = _error_code
791
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
793
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
794
openpgp_crt_deinit.restype = None
795
796
openpgp_crt_get_fingerprint = (
797
_library.gnutls_openpgp_crt_get_fingerprint)
798
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
ctypes.c_void_p,
800
ctypes.POINTER(
801
ctypes.c_size_t)]
802
openpgp_crt_get_fingerprint.restype = _error_code
803
804
if check_version(b"3.6.4"):
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
807
certificate_type_get2.restype = _error_code
808
751
809
# Remove non-public functions
752
810
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
811
755
812
756
813
def call_pipe(connection, # : multiprocessing.Connection
757
814
func, *args, **kwargs):
758
815
"""This function is meant to be called by multiprocessing.Process
759
816
760
817
This function runs func(*args, **kwargs), and writes the resulting
761
818
return value on the provided multiprocessing.Connection.
762
819
"""
763
820
connection.send(func(*args, **kwargs))
764
821
connection.close()
765
822
766
class Client(object):
823
824
class Client:
767
825
"""A representation of a client host served by this server.
768
826
769
827
Attributes:
770
828
approved: bool(); 'None' if not yet approved/disapproved
771
829
approval_delay: datetime.timedelta(); Time to wait for approval
772
830
approval_duration: datetime.timedelta(); Duration of one approval
773
checker: subprocess.Popen(); a running checker process used
774
to see if the client lives.
775
'None' if no process is running.
831
checker: multiprocessing.Process(); a running checker process used
832
to see if the client lives. 'None' if no process is
833
running.
776
834
checker_callback_tag: a GLib event source tag, or None
777
835
checker_command: string; External command which is run to check
778
836
if client lives. %() expansions are done at
786
844
disable_initiator_tag: a GLib event source tag, or None
787
845
enabled: bool()
788
846
fingerprint: string (40 or 32 hexadecimal digits); used to
789
uniquely identify the client
847
uniquely identify an OpenPGP client
848
key_id: string (64 hexadecimal digits); used to uniquely identify
849
a client using raw public keys
790
850
host: string; available for use by the checker command
791
851
interval: datetime.timedelta(); How often to start a new checker
792
852
last_approval_request: datetime.datetime(); (UTC) or None
808
868
disabled, or None
809
869
server_settings: The server_settings dict from main()
810
870
"""
811
871
812
872
runtime_expansions = ("approval_delay", "approval_duration",
813
"created", "enabled", "expires",
873
"created", "enabled", "expires", "key_id",
814
874
"fingerprint", "host", "interval",
815
875
"last_approval_request", "last_checked_ok",
816
876
"last_enabled", "name", "timeout")
825
885
"approved_by_default": "True",
826
886
"enabled": "True",
827
887
}
828
888
829
889
@staticmethod
830
890
def config_parser(config):
831
891
"""Construct a new dict of client settings of this form:
838
898
for client_name in config.sections():
839
899
section = dict(config.items(client_name))
840
900
client = settings[client_name] = {}
841
901
842
902
client["host"] = section["host"]
843
903
# Reformat values from string types to Python types
844
904
client["approved_by_default"] = config.getboolean(
845
905
client_name, "approved_by_default")
846
906
client["enabled"] = config.getboolean(client_name,
847
907
"enabled")
848
849
# Uppercase and remove spaces from fingerprint for later
850
# comparison purposes with return value from the
851
# fingerprint() function
908
909
# Uppercase and remove spaces from key_id and fingerprint
910
# for later comparison purposes with return value from the
911
# key_id() and fingerprint() functions
912
client["key_id"] = (section.get("key_id", "").upper()
913
.replace(" ", ""))
852
914
client["fingerprint"] = (section["fingerprint"].upper()
853
915
.replace(" ", ""))
854
916
if "secret" in section:
875
937
client["last_approval_request"] = None
876
938
client["last_checked_ok"] = None
877
939
client["last_checker_status"] = -2
878
940
879
941
return settings
880
881
def __init__(self, settings, name = None, server_settings=None):
942
943
def __init__(self, settings, name=None, server_settings=None):
882
944
self.name = name
883
945
if server_settings is None:
884
946
server_settings = {}
886
948
# adding all client settings
887
949
for setting, value in settings.items():
888
950
setattr(self, setting, value)
889
951
890
952
if self.enabled:
891
953
if not hasattr(self, "last_enabled"):
892
954
self.last_enabled = datetime.datetime.utcnow()
896
958
else:
897
959
self.last_enabled = None
898
960
self.expires = None
899
961
900
962
logger.debug("Creating client %r", self.name)
963
logger.debug(" Key ID: %s", self.key_id)
901
964
logger.debug(" Fingerprint: %s", self.fingerprint)
902
965
self.created = settings.get("created",
903
966
datetime.datetime.utcnow())
904
967
905
968
# attributes specific for this server instance
906
969
self.checker = None
907
970
self.checker_initiator_tag = None
916
979
for attr in self.__dict__.keys()
917
980
if not attr.startswith("_")]
918
981
self.client_structure.append("client_structure")
919
982
920
983
for name, t in inspect.getmembers(
921
984
type(self), lambda obj: isinstance(obj, property)):
922
985
if not name.startswith("_"):
923
986
self.client_structure.append(name)
924
987
925
988
# Send notice to process children that client state has changed
926
989
def send_changedstate(self):
927
990
with self.changedstate:
928
991
self.changedstate.notify_all()
929
992
930
993
def enable(self):
931
994
"""Start this client's checker and timeout hooks"""
932
995
if getattr(self, "enabled", False):
937
1000
self.last_enabled = datetime.datetime.utcnow()
938
1001
self.init_checker()
939
1002
self.send_changedstate()
940
1003
941
1004
def disable(self, quiet=True):
942
1005
"""Disable this client."""
943
1006
if not getattr(self, "enabled", False):
957
1020
self.send_changedstate()
958
1021
# Do not run this again if called by a GLib.timeout_add
959
1022
return False
960
1023
961
1024
def __del__(self):
962
1025
self.disable()
963
1026
964
1027
def init_checker(self):
965
1028
# Schedule a new checker to be started an 'interval' from now,
966
1029
# and every interval from then on.
976
1039
int(self.timeout.total_seconds() * 1000), self.disable)
977
1040
# Also start a new checker *right now*.
978
1041
self.start_checker()
979
1042
980
1043
def checker_callback(self, source, condition, connection,
981
1044
command):
982
1045
"""The checker has completed, so take appropriate actions."""
983
self.checker_callback_tag = None
984
self.checker = None
985
1046
# Read return code from connection (see call_pipe)
986
1047
returncode = connection.recv()
987
1048
connection.close()
988
1049
self.checker.join()
1050
self.checker_callback_tag = None
1051
self.checker = None
1052
989
1053
if returncode >= 0:
990
1054
self.last_checker_status = returncode
991
1055
self.last_checker_signal = None
1001
1065
logger.warning("Checker for %(name)s crashed?",
1002
1066
vars(self))
1003
1067
return False
1004
1068
1005
1069
def checked_ok(self):
1006
1070
"""Assert that the client has been seen, alive and well."""
1007
1071
self.last_checked_ok = datetime.datetime.utcnow()
1008
1072
self.last_checker_status = 0
1009
1073
self.last_checker_signal = None
1010
1074
self.bump_timeout()
1011
1075
1012
1076
def bump_timeout(self, timeout=None):
1013
1077
"""Bump up the timeout for this client."""
1014
1078
if timeout is None:
1020
1084
self.disable_initiator_tag = GLib.timeout_add(
1021
1085
int(timeout.total_seconds() * 1000), self.disable)
1022
1086
self.expires = datetime.datetime.utcnow() + timeout
1023
1087
1024
1088
def need_approval(self):
1025
1089
self.last_approval_request = datetime.datetime.utcnow()
1026
1090
1027
1091
def start_checker(self):
1028
1092
"""Start a new checker subprocess if one is not running.
1029
1093
1030
1094
If a checker already exists, leave it running and do
1031
1095
nothing."""
1032
1096
# The reason for not killing a running checker is that if we
1037
1101
# checkers alone, the checker would have to take more time
1038
1102
# than 'timeout' for the client to be disabled, which is as it
1039
1103
# should be.
1040
1104
1041
1105
if self.checker is not None and not self.checker.is_alive():
1042
1106
logger.warning("Checker was not alive; joining")
1043
1107
self.checker.join()
1047
1111
# Escape attributes for the shell
1048
1112
escaped_attrs = {
1049
1113
attr: re.escape(str(getattr(self, attr)))
1050
for attr in self.runtime_expansions }
1114
for attr in self.runtime_expansions}
1051
1115
try:
1052
1116
command = self.checker_command % escaped_attrs
1053
1117
except TypeError as error:
1065
1129
# The exception is when not debugging but nevertheless
1066
1130
# running in the foreground; use the previously
1067
1131
# created wnull.
1068
popen_args = { "close_fds": True,
1069
"shell": True,
1070
"cwd": "/" }
1132
popen_args = {"close_fds": True,
1133
"shell": True,
1134
"cwd": "/"}
1071
1135
if (not self.server_settings["debug"]
1072
1136
and self.server_settings["foreground"]):
1073
1137
popen_args.update({"stdout": wnull,
1074
"stderr": wnull })
1075
pipe = multiprocessing.Pipe(duplex = False)
1138
"stderr": wnull})
1139
pipe = multiprocessing.Pipe(duplex=False)
1076
1140
self.checker = multiprocessing.Process(
1077
target = call_pipe,
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1141
target=call_pipe,
1142
args=(pipe[1], subprocess.call, command),
1143
kwargs=popen_args)
1080
1144
self.checker.start()
1081
1145
self.checker_callback_tag = GLib.io_add_watch(
1082
1146
pipe[0].fileno(), GLib.IO_IN,
1083
1147
self.checker_callback, pipe[0], command)
1084
1148
# Re-run this periodically if run by GLib.timeout_add
1085
1149
return True
1086
1150
1087
1151
def stop_checker(self):
1088
1152
"""Force the checker process, if any, to stop."""
1089
1153
if self.checker_callback_tag:
1102
1166
byte_arrays=False):
1103
1167
"""Decorators for marking methods of a DBusObjectWithProperties to
1104
1168
become properties on the D-Bus.
1105
1169
1106
1170
The decorated method will be called with no arguments by "Get"
1107
1171
and with one argument by "Set".
1108
1172
1109
1173
The parameters, where they are supported, are the same as
1110
1174
dbus.service.method, except there is only "signature", since the
1111
1175
type from Get() and the type sent to Set() is the same.
1115
1179
if byte_arrays and signature != "ay":
1116
1180
raise ValueError("Byte arrays not supported for non-'ay'"
1117
1181
" signature {!r}".format(signature))
1118
1182
1119
1183
def decorator(func):
1120
1184
func._dbus_is_property = True
1121
1185
func._dbus_interface = dbus_interface
1124
1188
func._dbus_name = func.__name__
1125
1189
if func._dbus_name.endswith("_dbus_property"):
1126
1190
func._dbus_name = func._dbus_name[:-14]
1127
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1191
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1128
1192
return func
1129
1193
1130
1194
return decorator
1131
1195
1132
1196
1133
1197
def dbus_interface_annotations(dbus_interface):
1134
1198
"""Decorator for marking functions returning interface annotations
1135
1199
1136
1200
Usage:
1137
1201
1138
1202
@dbus_interface_annotations("org.example.Interface")
1139
1203
def _foo(self): # Function name does not matter
1140
1204
return {"org.freedesktop.DBus.Deprecated": "true",
1141
1205
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1142
1206
"false"}
1143
1207
"""
1144
1208
1145
1209
def decorator(func):
1146
1210
func._dbus_is_interface = True
1147
1211
func._dbus_interface = dbus_interface
1148
1212
func._dbus_name = dbus_interface
1149
1213
return func
1150
1214
1151
1215
return decorator
1152
1216
1153
1217
1154
1218
def dbus_annotations(annotations):
1155
1219
"""Decorator to annotate D-Bus methods, signals or properties
1156
1220
Usage:
1157
1221
1158
1222
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1159
1223
"org.freedesktop.DBus.Property."
1160
1224
"EmitsChangedSignal": "false"})
1162
1226
access="r")
1163
1227
def Property_dbus_property(self):
1164
1228
return dbus.Boolean(False)
1165
1229
1166
1230
See also the DBusObjectWithAnnotations class.
1167
1231
"""
1168
1232
1169
1233
def decorator(func):
1170
1234
func._dbus_annotations = annotations
1171
1235
return func
1172
1236
1173
1237
return decorator
1174
1238
1175
1239
1193
1257
1194
1258
class DBusObjectWithAnnotations(dbus.service.Object):
1195
1259
"""A D-Bus object with annotations.
1196
1260
1197
1261
Classes inheriting from this can use the dbus_annotations
1198
1262
decorator to add annotations to methods or signals.
1199
1263
"""
1200
1264
1201
1265
@staticmethod
1202
1266
def _is_dbus_thing(thing):
1203
1267
"""Returns a function testing if an attribute is a D-Bus thing
1204
1268
1205
1269
If called like _is_dbus_thing("method") it returns a function
1206
1270
suitable for use as predicate to inspect.getmembers().
1207
1271
"""
1208
1272
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1209
1273
False)
1210
1274
1211
1275
def _get_all_dbus_things(self, thing):
1212
1276
"""Returns a generator of (name, attribute) pairs
1213
1277
"""
1216
1280
for cls in self.__class__.__mro__
1217
1281
for name, athing in
1218
1282
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1219
1283
1220
1284
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1285
out_signature="s",
1286
path_keyword='object_path',
1287
connection_keyword='connection')
1224
1288
def Introspect(self, object_path, connection):
1225
1289
"""Overloading of standard D-Bus method.
1226
1290
1227
1291
Inserts annotation tags on methods and signals.
1228
1292
"""
1229
1293
xmlstring = dbus.service.Object.Introspect(self, object_path,
1230
1294
connection)
1231
1295
try:
1232
1296
document = xml.dom.minidom.parseString(xmlstring)
1233
1297
1234
1298
for if_tag in document.getElementsByTagName("interface"):
1235
1299
# Add annotation tags
1236
1300
for typ in ("method", "signal"):
1263
1327
if_tag.appendChild(ann_tag)
1264
1328
# Fix argument name for the Introspect method itself
1265
1329
if (if_tag.getAttribute("name")
1266
== dbus.INTROSPECTABLE_IFACE):
1330
== dbus.INTROSPECTABLE_IFACE):
1267
1331
for cn in if_tag.getElementsByTagName("method"):
1268
1332
if cn.getAttribute("name") == "Introspect":
1269
1333
for arg in cn.getElementsByTagName("arg"):
1282
1346
1283
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1284
1348
"""A D-Bus object with properties.
1285
1349
1286
1350
Classes inheriting from this can use the dbus_service_property
1287
1351
decorator to expose methods as D-Bus properties. It exposes the
1288
1352
standard Get(), Set(), and GetAll() methods on the D-Bus.
1289
1353
"""
1290
1354
1291
1355
def _get_dbus_property(self, interface_name, property_name):
1292
1356
"""Returns a bound method if one exists which is a D-Bus
1293
1357
property with the specified name and interface.
1298
1362
if (value._dbus_name == property_name
1299
1363
and value._dbus_interface == interface_name):
1300
1364
return value.__get__(self)
1301
1365
1302
1366
# No such property
1303
1367
raise DBusPropertyNotFound("{}:{}.{}".format(
1304
1368
self.dbus_object_path, interface_name, property_name))
1305
1369
1306
1370
@classmethod
1307
1371
def _get_all_interface_names(cls):
1308
1372
"""Get a sequence of all interfaces supported by an object"""
1311
1375
for x in (inspect.getmro(cls))
1312
1376
for attr in dir(x))
1313
1377
if name is not None)
1314
1378
1315
1379
@dbus.service.method(dbus.PROPERTIES_IFACE,
1316
1380
in_signature="ss",
1317
1381
out_signature="v")
1325
1389
if not hasattr(value, "variant_level"):
1326
1390
return value
1327
1391
return type(value)(value, variant_level=value.variant_level+1)
1328
1392
1329
1393
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1330
1394
def Set(self, interface_name, property_name, value):
1331
1395
"""Standard D-Bus property Set() method, see D-Bus standard.
1343
1407
value = dbus.ByteArray(b''.join(chr(byte)
1344
1408
for byte in value))
1345
1409
prop(value)
1346
1410
1347
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1348
1412
in_signature="s",
1349
1413
out_signature="a{sv}")
1350
1414
def GetAll(self, interface_name):
1351
1415
"""Standard D-Bus property GetAll() method, see D-Bus
1352
1416
standard.
1353
1417
1354
1418
Note: Will not include properties with access="write".
1355
1419
"""
1356
1420
properties = {}
1367
1431
properties[name] = value
1368
1432
continue
1369
1433
properties[name] = type(value)(
1370
value, variant_level = value.variant_level + 1)
1434
value, variant_level=value.variant_level + 1)
1371
1435
return dbus.Dictionary(properties, signature="sv")
1372
1436
1373
1437
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1374
1438
def PropertiesChanged(self, interface_name, changed_properties,
1375
1439
invalidated_properties):
1377
1441
standard.
1378
1442
"""
1379
1443
pass
1380
1444
1381
1445
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1382
1446
out_signature="s",
1383
1447
path_keyword='object_path',
1384
1448
connection_keyword='connection')
1385
1449
def Introspect(self, object_path, connection):
1386
1450
"""Overloading of standard D-Bus method.
1387
1451
1388
1452
Inserts property tags and interface annotation tags.
1389
1453
"""
1390
1454
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1392
1456
connection)
1393
1457
try:
1394
1458
document = xml.dom.minidom.parseString(xmlstring)
1395
1459
1396
1460
def make_tag(document, name, prop):
1397
1461
e = document.createElement("property")
1398
1462
e.setAttribute("name", name)
1399
1463
e.setAttribute("type", prop._dbus_signature)
1400
1464
e.setAttribute("access", prop._dbus_access)
1401
1465
return e
1402
1466
1403
1467
for if_tag in document.getElementsByTagName("interface"):
1404
1468
# Add property tags
1405
1469
for tag in (make_tag(document, name, prop)
1447
1511
exc_info=error)
1448
1512
return xmlstring
1449
1513
1514
1450
1515
try:
1451
1516
dbus.OBJECT_MANAGER_IFACE
1452
1517
except AttributeError:
1453
1518
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1454
1519
1520
1455
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1456
1522
"""A D-Bus object with an ObjectManager.
1457
1523
1458
1524
Classes inheriting from this exposes the standard
1459
1525
GetManagedObjects call and the InterfacesAdded and
1460
1526
InterfacesRemoved signals on the standard
1461
1527
"org.freedesktop.DBus.ObjectManager" interface.
1462
1528
1463
1529
Note: No signals are sent automatically; they must be sent
1464
1530
manually.
1465
1531
"""
1466
1532
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1467
out_signature = "a{oa{sa{sv}}}")
1533
out_signature="a{oa{sa{sv}}}")
1468
1534
def GetManagedObjects(self):
1469
1535
"""This function must be overridden"""
1470
1536
raise NotImplementedError()
1471
1537
1472
1538
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1473
signature = "oa{sa{sv}}")
1539
signature="oa{sa{sv}}")
1474
1540
def InterfacesAdded(self, object_path, interfaces_and_properties):
1475
1541
pass
1476
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1542
1543
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1478
1544
def InterfacesRemoved(self, object_path, interfaces):
1479
1545
pass
1480
1546
1481
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1548
out_signature="s",
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1485
1551
def Introspect(self, object_path, connection):
1486
1552
"""Overloading of standard D-Bus method.
1487
1553
1488
1554
Override return argument name of GetManagedObjects to be
1489
1555
"objpath_interfaces_and_properties"
1490
1556
"""
1493
1559
connection)
1494
1560
try:
1495
1561
document = xml.dom.minidom.parseString(xmlstring)
1496
1562
1497
1563
for if_tag in document.getElementsByTagName("interface"):
1498
1564
# Fix argument name for the GetManagedObjects method
1499
1565
if (if_tag.getAttribute("name")
1500
== dbus.OBJECT_MANAGER_IFACE):
1566
== dbus.OBJECT_MANAGER_IFACE):
1501
1567
for cn in if_tag.getElementsByTagName("method"):
1502
1568
if (cn.getAttribute("name")
1503
1569
== "GetManagedObjects"):
1513
1579
except (AttributeError, xml.dom.DOMException,
1514
1580
xml.parsers.expat.ExpatError) as error:
1515
1581
logger.error("Failed to override Introspection method",
1516
exc_info = error)
1582
exc_info=error)
1517
1583
return xmlstring
1518
1584
1585
1519
1586
def datetime_to_dbus(dt, variant_level=0):
1520
1587
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1521
1588
if dt is None:
1522
return dbus.String("", variant_level = variant_level)
1589
return dbus.String("", variant_level=variant_level)
1523
1590
return dbus.String(dt.isoformat(), variant_level=variant_level)
1524
1591
1525
1592
1528
1595
dbus.service.Object, it will add alternate D-Bus attributes with
1529
1596
interface names according to the "alt_interface_names" mapping.
1530
1597
Usage:
1531
1598
1532
1599
@alternate_dbus_interfaces({"org.example.Interface":
1533
1600
"net.example.AlternateInterface"})
1534
1601
class SampleDBusObject(dbus.service.Object):
1535
1602
@dbus.service.method("org.example.Interface")
1536
1603
def SampleDBusMethod():
1537
1604
pass
1538
1605
1539
1606
The above "SampleDBusMethod" on "SampleDBusObject" will be
1540
1607
reachable via two interfaces: "org.example.Interface" and
1541
1608
"net.example.AlternateInterface", the latter of which will have
1542
1609
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1543
1610
"true", unless "deprecate" is passed with a False value.
1544
1611
1545
1612
This works for methods and signals, and also for D-Bus properties
1546
1613
(from DBusObjectWithProperties) and interfaces (from the
1547
1614
dbus_interface_annotations decorator).
1548
1615
"""
1549
1616
1550
1617
def wrapper(cls):
1551
1618
for orig_interface_name, alt_interface_name in (
1552
1619
alt_interface_names.items()):
1592
1659
attribute._dbus_annotations)
1593
1660
except AttributeError:
1594
1661
pass
1662
1595
1663
# Define a creator of a function to call both the
1596
1664
# original and alternate functions, so both the
1597
1665
# original and alternate signals gets sent when
1600
1668
"""This function is a scope container to pass
1601
1669
func1 and func2 to the "call_both" function
1602
1670
outside of its arguments"""
1603
1671
1604
1672
@functools.wraps(func2)
1605
1673
def call_both(*args, **kwargs):
1606
1674
"""This function will emit two D-Bus
1607
1675
signals by calling func1 and func2"""
1608
1676
func1(*args, **kwargs)
1609
1677
func2(*args, **kwargs)
1610
# Make wrapper function look like a D-Bus signal
1678
# Make wrapper function look like a D-Bus
1679
# signal
1611
1680
for name, attr in inspect.getmembers(func2):
1612
1681
if name.startswith("_dbus_"):
1613
1682
setattr(call_both, name, attr)
1614
1683
1615
1684
return call_both
1616
1685
# Create the "call_both" function and add it to
1617
1686
# the class
1663
1732
(copy_function(attribute)))
1664
1733
if deprecate:
1665
1734
# Deprecate all alternate interfaces
1666
iname="_AlternateDBusNames_interface_annotation{}"
1735
iname = "_AlternateDBusNames_interface_annotation{}"
1667
1736
for interface_name in interface_names:
1668
1737
1669
1738
@dbus_interface_annotations(interface_name)
1670
1739
def func(self):
1671
return { "org.freedesktop.DBus.Deprecated":
1672
"true" }
1740
return {"org.freedesktop.DBus.Deprecated":
1741
"true"}
1673
1742
# Find an unused name
1674
1743
for aname in (iname.format(i)
1675
1744
for i in itertools.count()):
1686
1755
cls = type("{}Alternate".format(cls.__name__),
1687
1756
(cls, ), attr)
1688
1757
return cls
1689
1758
1690
1759
return wrapper
1691
1760
1692
1761
1694
1763
"se.bsnet.fukt.Mandos"})
1695
1764
class ClientDBus(Client, DBusObjectWithProperties):
1696
1765
"""A Client class using D-Bus
1697
1766
1698
1767
Attributes:
1699
1768
dbus_object_path: dbus.ObjectPath
1700
1769
bus: dbus.SystemBus()
1701
1770
"""
1702
1771
1703
1772
runtime_expansions = (Client.runtime_expansions
1704
1773
+ ("dbus_object_path", ))
1705
1774
1706
1775
_interface = "se.recompile.Mandos.Client"
1707
1776
1708
1777
# dbus.service.Object doesn't use super(), so we can't either.
1709
1710
def __init__(self, bus = None, *args, **kwargs):
1778
1779
def __init__(self, bus=None, *args, **kwargs):
1711
1780
self.bus = bus
1712
1781
Client.__init__(self, *args, **kwargs)
1713
1782
# Only now, when this client is initialized, can it show up on
1719
1788
"/clients/" + client_object_name)
1720
1789
DBusObjectWithProperties.__init__(self, self.bus,
1721
1790
self.dbus_object_path)
1722
1791
1723
1792
def notifychangeproperty(transform_func, dbus_name,
1724
1793
type_func=lambda x: x,
1725
1794
variant_level=1,
1727
1796
_interface=_interface):
1728
1797
""" Modify a variable so that it's a property which announces
1729
1798
its changes to DBus.
1730
1799
1731
1800
transform_fun: Function that takes a value and a variant_level
1732
1801
and transforms it to a D-Bus type.
1733
1802
dbus_name: D-Bus name of the variable
1736
1805
variant_level: D-Bus variant level. Default: 1
1737
1806
"""
1738
1807
attrname = "_{}".format(dbus_name)
1739
1808
1740
1809
def setter(self, value):
1741
1810
if hasattr(self, "dbus_object_path"):
1742
1811
if (not hasattr(self, attrname) or
1749
1818
else:
1750
1819
dbus_value = transform_func(
1751
1820
type_func(value),
1752
variant_level = variant_level)
1821
variant_level=variant_level)
1753
1822
self.PropertyChanged(dbus.String(dbus_name),
1754
1823
dbus_value)
1755
1824
self.PropertiesChanged(
1756
1825
_interface,
1757
dbus.Dictionary({ dbus.String(dbus_name):
1758
dbus_value }),
1826
dbus.Dictionary({dbus.String(dbus_name):
1827
dbus_value}),
1759
1828
dbus.Array())
1760
1829
setattr(self, attrname, value)
1761
1830
1762
1831
return property(lambda self: getattr(self, attrname), setter)
1763
1832
1764
1833
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1765
1834
approvals_pending = notifychangeproperty(dbus.Boolean,
1766
1835
"ApprovalPending",
1767
type_func = bool)
1836
type_func=bool)
1768
1837
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1769
1838
last_enabled = notifychangeproperty(datetime_to_dbus,
1770
1839
"LastEnabled")
1771
1840
checker = notifychangeproperty(
1772
1841
dbus.Boolean, "CheckerRunning",
1773
type_func = lambda checker: checker is not None)
1842
type_func=lambda checker: checker is not None)
1774
1843
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1775
1844
"LastCheckedOK")
1776
1845
last_checker_status = notifychangeproperty(dbus.Int16,
1781
1850
"ApprovedByDefault")
1782
1851
approval_delay = notifychangeproperty(
1783
1852
dbus.UInt64, "ApprovalDelay",
1784
type_func = lambda td: td.total_seconds() * 1000)
1853
type_func=lambda td: td.total_seconds() * 1000)
1785
1854
approval_duration = notifychangeproperty(
1786
1855
dbus.UInt64, "ApprovalDuration",
1787
type_func = lambda td: td.total_seconds() * 1000)
1856
type_func=lambda td: td.total_seconds() * 1000)
1788
1857
host = notifychangeproperty(dbus.String, "Host")
1789
1858
timeout = notifychangeproperty(
1790
1859
dbus.UInt64, "Timeout",
1791
type_func = lambda td: td.total_seconds() * 1000)
1860
type_func=lambda td: td.total_seconds() * 1000)
1792
1861
extended_timeout = notifychangeproperty(
1793
1862
dbus.UInt64, "ExtendedTimeout",
1794
type_func = lambda td: td.total_seconds() * 1000)
1863
type_func=lambda td: td.total_seconds() * 1000)
1795
1864
interval = notifychangeproperty(
1796
1865
dbus.UInt64, "Interval",
1797
type_func = lambda td: td.total_seconds() * 1000)
1866
type_func=lambda td: td.total_seconds() * 1000)
1798
1867
checker_command = notifychangeproperty(dbus.String, "Checker")
1799
1868
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1800
1869
invalidate_only=True)
1801
1870
1802
1871
del notifychangeproperty
1803
1872
1804
1873
def __del__(self, *args, **kwargs):
1805
1874
try:
1806
1875
self.remove_from_connection()
1809
1878
if hasattr(DBusObjectWithProperties, "__del__"):
1810
1879
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1811
1880
Client.__del__(self, *args, **kwargs)
1812
1881
1813
1882
def checker_callback(self, source, condition,
1814
1883
connection, command, *args, **kwargs):
1815
1884
ret = Client.checker_callback(self, source, condition,
1831
1900
| self.last_checker_signal),
1832
1901
dbus.String(command))
1833
1902
return ret
1834
1903
1835
1904
def start_checker(self, *args, **kwargs):
1836
1905
old_checker_pid = getattr(self.checker, "pid", None)
1837
1906
r = Client.start_checker(self, *args, **kwargs)
1841
1910
# Emit D-Bus signal
1842
1911
self.CheckerStarted(self.current_checker_command)
1843
1912
return r
1844
1913
1845
1914
def _reset_approved(self):
1846
1915
self.approved = None
1847
1916
return False
1848
1917
1849
1918
def approve(self, value=True):
1850
1919
self.approved = value
1851
1920
GLib.timeout_add(int(self.approval_duration.total_seconds()
1852
1921
* 1000), self._reset_approved)
1853
1922
self.send_changedstate()
1854
1855
## D-Bus methods, signals & properties
1856
1857
## Interfaces
1858
1859
## Signals
1860
1923
1924
# D-Bus methods, signals & properties
1925
1926
# Interfaces
1927
1928
# Signals
1929
1861
1930
# CheckerCompleted - signal
1862
1931
@dbus.service.signal(_interface, signature="nxs")
1863
1932
def CheckerCompleted(self, exitcode, waitstatus, command):
1864
1933
"D-Bus signal"
1865
1934
pass
1866
1935
1867
1936
# CheckerStarted - signal
1868
1937
@dbus.service.signal(_interface, signature="s")
1869
1938
def CheckerStarted(self, command):
1870
1939
"D-Bus signal"
1871
1940
pass
1872
1941
1873
1942
# PropertyChanged - signal
1874
1943
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1875
1944
@dbus.service.signal(_interface, signature="sv")
1876
1945
def PropertyChanged(self, property, value):
1877
1946
"D-Bus signal"
1878
1947
pass
1879
1948
1880
1949
# GotSecret - signal
1881
1950
@dbus.service.signal(_interface)
1882
1951
def GotSecret(self):
1885
1954
server to mandos-client
1886
1955
"""
1887
1956
pass
1888
1957
1889
1958
# Rejected - signal
1890
1959
@dbus.service.signal(_interface, signature="s")
1891
1960
def Rejected(self, reason):
1892
1961
"D-Bus signal"
1893
1962
pass
1894
1963
1895
1964
# NeedApproval - signal
1896
1965
@dbus.service.signal(_interface, signature="tb")
1897
1966
def NeedApproval(self, timeout, default):
1898
1967
"D-Bus signal"
1899
1968
return self.need_approval()
1900
1901
## Methods
1902
1969
1970
# Methods
1971
1903
1972
# Approve - method
1904
1973
@dbus.service.method(_interface, in_signature="b")
1905
1974
def Approve(self, value):
1906
1975
self.approve(value)
1907
1976
1908
1977
# CheckedOK - method
1909
1978
@dbus.service.method(_interface)
1910
1979
def CheckedOK(self):
1911
1980
self.checked_ok()
1912
1981
1913
1982
# Enable - method
1914
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1915
1984
@dbus.service.method(_interface)
1916
1985
def Enable(self):
1917
1986
"D-Bus method"
1918
1987
self.enable()
1919
1988
1920
1989
# StartChecker - method
1921
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1922
1991
@dbus.service.method(_interface)
1923
1992
def StartChecker(self):
1924
1993
"D-Bus method"
1925
1994
self.start_checker()
1926
1995
1927
1996
# Disable - method
1928
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1929
1998
@dbus.service.method(_interface)
1930
1999
def Disable(self):
1931
2000
"D-Bus method"
1932
2001
self.disable()
1933
2002
1934
2003
# StopChecker - method
1935
2004
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1936
2005
@dbus.service.method(_interface)
1937
2006
def StopChecker(self):
1938
2007
self.stop_checker()
1939
1940
## Properties
1941
2008
2009
# Properties
2010
1942
2011
# ApprovalPending - property
1943
2012
@dbus_service_property(_interface, signature="b", access="read")
1944
2013
def ApprovalPending_dbus_property(self):
1945
2014
return dbus.Boolean(bool(self.approvals_pending))
1946
2015
1947
2016
# ApprovedByDefault - property
1948
2017
@dbus_service_property(_interface,
1949
2018
signature="b",
1952
2021
if value is None: # get
1953
2022
return dbus.Boolean(self.approved_by_default)
1954
2023
self.approved_by_default = bool(value)
1955
2024
1956
2025
# ApprovalDelay - property
1957
2026
@dbus_service_property(_interface,
1958
2027
signature="t",
1962
2031
return dbus.UInt64(self.approval_delay.total_seconds()
1963
2032
* 1000)
1964
2033
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1965
2034
1966
2035
# ApprovalDuration - property
1967
2036
@dbus_service_property(_interface,
1968
2037
signature="t",
1972
2041
return dbus.UInt64(self.approval_duration.total_seconds()
1973
2042
* 1000)
1974
2043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1975
2044
1976
2045
# Name - property
1977
2046
@dbus_annotations(
1978
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1979
2048
@dbus_service_property(_interface, signature="s", access="read")
1980
2049
def Name_dbus_property(self):
1981
2050
return dbus.String(self.name)
1982
2051
2052
# KeyID - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2055
@dbus_service_property(_interface, signature="s", access="read")
2056
def KeyID_dbus_property(self):
2057
return dbus.String(self.key_id)
2058
1983
2059
# Fingerprint - property
1984
2060
@dbus_annotations(
1985
2061
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
2062
@dbus_service_property(_interface, signature="s", access="read")
1987
2063
def Fingerprint_dbus_property(self):
1988
2064
return dbus.String(self.fingerprint)
1989
2065
1990
2066
# Host - property
1991
2067
@dbus_service_property(_interface,
1992
2068
signature="s",
1995
2071
if value is None: # get
1996
2072
return dbus.String(self.host)
1997
2073
self.host = str(value)
1998
2074
1999
2075
# Created - property
2000
2076
@dbus_annotations(
2001
2077
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2002
2078
@dbus_service_property(_interface, signature="s", access="read")
2003
2079
def Created_dbus_property(self):
2004
2080
return datetime_to_dbus(self.created)
2005
2081
2006
2082
# LastEnabled - property
2007
2083
@dbus_service_property(_interface, signature="s", access="read")
2008
2084
def LastEnabled_dbus_property(self):
2009
2085
return datetime_to_dbus(self.last_enabled)
2010
2086
2011
2087
# Enabled - property
2012
2088
@dbus_service_property(_interface,
2013
2089
signature="b",
2019
2095
self.enable()
2020
2096
else:
2021
2097
self.disable()
2022
2098
2023
2099
# LastCheckedOK - property
2024
2100
@dbus_service_property(_interface,
2025
2101
signature="s",
2029
2105
self.checked_ok()
2030
2106
return
2031
2107
return datetime_to_dbus(self.last_checked_ok)
2032
2108
2033
2109
# LastCheckerStatus - property
2034
2110
@dbus_service_property(_interface, signature="n", access="read")
2035
2111
def LastCheckerStatus_dbus_property(self):
2036
2112
return dbus.Int16(self.last_checker_status)
2037
2113
2038
2114
# Expires - property
2039
2115
@dbus_service_property(_interface, signature="s", access="read")
2040
2116
def Expires_dbus_property(self):
2041
2117
return datetime_to_dbus(self.expires)
2042
2118
2043
2119
# LastApprovalRequest - property
2044
2120
@dbus_service_property(_interface, signature="s", access="read")
2045
2121
def LastApprovalRequest_dbus_property(self):
2046
2122
return datetime_to_dbus(self.last_approval_request)
2047
2123
2048
2124
# Timeout - property
2049
2125
@dbus_service_property(_interface,
2050
2126
signature="t",
2069
2145
self.disable_initiator_tag = GLib.timeout_add(
2070
2146
int((self.expires - now).total_seconds() * 1000),
2071
2147
self.disable)
2072
2148
2073
2149
# ExtendedTimeout - property
2074
2150
@dbus_service_property(_interface,
2075
2151
signature="t",
2079
2155
return dbus.UInt64(self.extended_timeout.total_seconds()
2080
2156
* 1000)
2081
2157
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2082
2158
2083
2159
# Interval - property
2084
2160
@dbus_service_property(_interface,
2085
2161
signature="t",
2095
2171
GLib.source_remove(self.checker_initiator_tag)
2096
2172
self.checker_initiator_tag = GLib.timeout_add(
2097
2173
value, self.start_checker)
2098
self.start_checker() # Start one now, too
2099
2174
self.start_checker() # Start one now, too
2175
2100
2176
# Checker - property
2101
2177
@dbus_service_property(_interface,
2102
2178
signature="s",
2105
2181
if value is None: # get
2106
2182
return dbus.String(self.checker_command)
2107
2183
self.checker_command = str(value)
2108
2184
2109
2185
# CheckerRunning - property
2110
2186
@dbus_service_property(_interface,
2111
2187
signature="b",
2117
2193
self.start_checker()
2118
2194
else:
2119
2195
self.stop_checker()
2120
2196
2121
2197
# ObjectPath - property
2122
2198
@dbus_annotations(
2123
2199
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2124
2200
"org.freedesktop.DBus.Deprecated": "true"})
2125
2201
@dbus_service_property(_interface, signature="o", access="read")
2126
2202
def ObjectPath_dbus_property(self):
2127
return self.dbus_object_path # is already a dbus.ObjectPath
2128
2203
return self.dbus_object_path # is already a dbus.ObjectPath
2204
2129
2205
# Secret = property
2130
2206
@dbus_annotations(
2131
2207
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2136
2212
byte_arrays=True)
2137
2213
def Secret_dbus_property(self, value):
2138
2214
self.secret = bytes(value)
2139
2215
2140
2216
del _interface
2141
2217
2142
2218
2143
class ProxyClient(object):
2144
def __init__(self, child_pipe, fpr, address):
2219
class ProxyClient:
2220
def __init__(self, child_pipe, key_id, fpr, address):
2145
2221
self._pipe = child_pipe
2146
self._pipe.send(('init', fpr, address))
2222
self._pipe.send(('init', key_id, fpr, address))
2147
2223
if not self._pipe.recv():
2148
raise KeyError(fpr)
2149
2224
raise KeyError(key_id or fpr)
2225
2150
2226
def __getattribute__(self, name):
2151
2227
if name == '_pipe':
2152
2228
return super(ProxyClient, self).__getattribute__(name)
2155
2231
if data[0] == 'data':
2156
2232
return data[1]
2157
2233
if data[0] == 'function':
2158
2234
2159
2235
def func(*args, **kwargs):
2160
2236
self._pipe.send(('funcall', name, args, kwargs))
2161
2237
return self._pipe.recv()[1]
2162
2238
2163
2239
return func
2164
2240
2165
2241
def __setattr__(self, name, value):
2166
2242
if name == '_pipe':
2167
2243
return super(ProxyClient, self).__setattr__(name, value)
2170
2246
2171
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
2172
2248
"""A class to handle client connections.
2173
2249
2174
2250
Instantiated once for each connection to handle it.
2175
2251
Note: This will run in its own forked process."""
2176
2252
2177
2253
def handle(self):
2178
2254
with contextlib.closing(self.server.child_pipe) as child_pipe:
2179
2255
logger.info("TCP connection from: %s",
2180
2256
str(self.client_address))
2181
2257
logger.debug("Pipe FD: %d",
2182
2258
self.server.child_pipe.fileno())
2183
2259
2184
2260
session = gnutls.ClientSession(self.request)
2185
2186
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
# "+AES-256-CBC", "+SHA1",
2188
# "+COMP-NULL", "+CTYPE-OPENPGP",
2189
# "+DHE-DSS"))
2261
2262
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2263
# "+AES-256-CBC", "+SHA1",
2264
# "+COMP-NULL", "+CTYPE-OPENPGP",
2265
# "+DHE-DSS"))
2190
2266
# Use a fallback default, since this MUST be set.
2191
2267
priority = self.server.gnutls_priority
2192
2268
if priority is None:
2194
2270
gnutls.priority_set_direct(session._c_object,
2195
2271
priority.encode("utf-8"),
2196
2272
None)
2197
2273
2198
2274
# Start communication using the Mandos protocol
2199
2275
# Get protocol number
2200
2276
line = self.request.makefile().readline()
2205
2281
except (ValueError, IndexError, RuntimeError) as error:
2206
2282
logger.error("Unknown protocol version: %s", error)
2207
2283
return
2208
2284
2209
2285
# Start GnuTLS connection
2210
2286
try:
2211
2287
session.handshake()
2215
2291
# established. Just abandon the request.
2216
2292
return
2217
2293
logger.debug("Handshake succeeded")
2218
2294
2219
2295
approval_required = False
2220
2296
try:
2221
try:
2222
fpr = self.fingerprint(
2223
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
2225
logger.warning("Bad certificate: %s", error)
2226
return
2227
logger.debug("Fingerprint: %s", fpr)
2228
2229
try:
2230
client = ProxyClient(child_pipe, fpr,
2297
if gnutls.has_rawpk:
2298
fpr = b""
2299
try:
2300
key_id = self.key_id(
2301
self.peer_certificate(session))
2302
except (TypeError, gnutls.Error) as error:
2303
logger.warning("Bad certificate: %s", error)
2304
return
2305
logger.debug("Key ID: %s", key_id)
2306
2307
else:
2308
key_id = b""
2309
try:
2310
fpr = self.fingerprint(
2311
self.peer_certificate(session))
2312
except (TypeError, gnutls.Error) as error:
2313
logger.warning("Bad certificate: %s", error)
2314
return
2315
logger.debug("Fingerprint: %s", fpr)
2316
2317
try:
2318
client = ProxyClient(child_pipe, key_id, fpr,
2231
2319
self.client_address)
2232
2320
except KeyError:
2233
2321
return
2234
2322
2235
2323
if client.approval_delay:
2236
2324
delay = client.approval_delay
2237
2325
client.approvals_pending += 1
2238
2326
approval_required = True
2239
2327
2240
2328
while True:
2241
2329
if not client.enabled:
2242
2330
logger.info("Client %s is disabled",
2245
2333
# Emit D-Bus signal
2246
2334
client.Rejected("Disabled")
2247
2335
return
2248
2336
2249
2337
if client.approved or not client.approval_delay:
2250
#We are approved or approval is disabled
2338
# We are approved or approval is disabled
2251
2339
break
2252
2340
elif client.approved is None:
2253
2341
logger.info("Client %s needs approval",
2264
2352
# Emit D-Bus signal
2265
2353
client.Rejected("Denied")
2266
2354
return
2267
2268
#wait until timeout or approved
2355
2356
# wait until timeout or approved
2269
2357
time = datetime.datetime.now()
2270
2358
client.changedstate.acquire()
2271
2359
client.changedstate.wait(delay.total_seconds())
2284
2372
break
2285
2373
else:
2286
2374
delay -= time2 - time
2287
2375
2288
2376
try:
2289
2377
session.send(client.secret)
2290
2378
except gnutls.Error as error:
2291
2379
logger.warning("gnutls send failed",
2292
exc_info = error)
2380
exc_info=error)
2293
2381
return
2294
2382
2295
2383
logger.info("Sending secret to %s", client.name)
2296
2384
# bump the timeout using extended_timeout
2297
2385
client.bump_timeout(client.extended_timeout)
2298
2386
if self.server.use_dbus:
2299
2387
# Emit D-Bus signal
2300
2388
client.GotSecret()
2301
2389
2302
2390
finally:
2303
2391
if approval_required:
2304
2392
client.approvals_pending -= 1
2307
2395
except gnutls.Error as error:
2308
2396
logger.warning("GnuTLS bye failed",
2309
2397
exc_info=error)
2310
2398
2311
2399
@staticmethod
2312
2400
def peer_certificate(session):
2313
"Return the peer's OpenPGP certificate as a bytestring"
2314
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2401
"Return the peer's certificate as a bytestring"
2402
try:
2403
cert_type = gnutls.certificate_type_get2(session._c_object,
2404
gnutls.CTYPE_PEERS)
2405
except AttributeError:
2406
cert_type = gnutls.certificate_type_get(session._c_object)
2407
if gnutls.has_rawpk:
2408
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2409
else:
2410
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2411
# If not a valid certificate type...
2412
if cert_type not in valid_cert_types:
2413
logger.info("Cert type %r not in %r", cert_type,
2414
valid_cert_types)
2317
2415
# ...return invalid data
2318
2416
return b""
2319
2417
list_size = ctypes.c_uint(1)
2325
2423
return None
2326
2424
cert = cert_list[0]
2327
2425
return ctypes.string_at(cert.data, cert.size)
2328
2426
2427
@staticmethod
2428
def key_id(certificate):
2429
"Convert a certificate bytestring to a hexdigit key ID"
2430
# New GnuTLS "datum" with the public key
2431
datum = gnutls.datum_t(
2432
ctypes.cast(ctypes.c_char_p(certificate),
2433
ctypes.POINTER(ctypes.c_ubyte)),
2434
ctypes.c_uint(len(certificate)))
2435
# XXX all these need to be created in the gnutls "module"
2436
# New empty GnuTLS certificate
2437
pubkey = gnutls.pubkey_t()
2438
gnutls.pubkey_init(ctypes.byref(pubkey))
2439
# Import the raw public key into the certificate
2440
gnutls.pubkey_import(pubkey,
2441
ctypes.byref(datum),
2442
gnutls.X509_FMT_DER)
2443
# New buffer for the key ID
2444
buf = ctypes.create_string_buffer(32)
2445
buf_len = ctypes.c_size_t(len(buf))
2446
# Get the key ID from the raw public key into the buffer
2447
gnutls.pubkey_get_key_id(pubkey,
2448
gnutls.KEYID_USE_SHA256,
2449
ctypes.cast(ctypes.byref(buf),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.byref(buf_len))
2452
# Deinit the certificate
2453
gnutls.pubkey_deinit(pubkey)
2454
2455
# Convert the buffer to a Python bytestring
2456
key_id = ctypes.string_at(buf, buf_len.value)
2457
# Convert the bytestring to hexadecimal notation
2458
hex_key_id = binascii.hexlify(key_id).upper()
2459
return hex_key_id
2460
2329
2461
@staticmethod
2330
2462
def fingerprint(openpgp):
2331
2463
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2346
2478
ctypes.byref(crtverify))
2347
2479
if crtverify.value != 0:
2348
2480
gnutls.openpgp_crt_deinit(crt)
2349
raise gnutls.CertificateSecurityError("Verify failed")
2481
raise gnutls.CertificateSecurityError(code
2482
=crtverify.value)
2350
2483
# New buffer for the fingerprint
2351
2484
buf = ctypes.create_string_buffer(20)
2352
2485
buf_len = ctypes.c_size_t()
2362
2495
return hex_fpr
2363
2496
2364
2497
2365
class MultiprocessingMixIn(object):
2498
class MultiprocessingMixIn:
2366
2499
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2367
2500
2368
2501
def sub_process_main(self, request, address):
2369
2502
try:
2370
2503
self.finish_request(request, address)
2371
2504
except Exception:
2372
2505
self.handle_error(request, address)
2373
2506
self.close_request(request)
2374
2507
2375
2508
def process_request(self, request, address):
2376
2509
"""Start a new process to process the request."""
2377
proc = multiprocessing.Process(target = self.sub_process_main,
2378
args = (request, address))
2510
proc = multiprocessing.Process(target=self.sub_process_main,
2511
args=(request, address))
2379
2512
proc.start()
2380
2513
return proc
2381
2514
2382
2515
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2384
2517
""" adds a pipe to the MixIn """
2385
2518
2386
2519
def process_request(self, request, client_address):
2387
2520
"""Overrides and wraps the original process_request().
2388
2521
2389
2522
This function creates a new pipe in self.pipe
2390
2523
"""
2391
2524
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2392
2525
2393
2526
proc = MultiprocessingMixIn.process_request(self, request,
2394
2527
client_address)
2395
2528
self.child_pipe.close()
2396
2529
self.add_pipe(parent_pipe, proc)
2397
2530
2398
2531
def add_pipe(self, parent_pipe, proc):
2399
2532
"""Dummy function; override as necessary"""
2400
2533
raise NotImplementedError()
2401
2534
2402
2535
2403
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2404
socketserver.TCPServer, object):
2537
socketserver.TCPServer):
2405
2538
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2406
2539
2407
2540
Attributes:
2408
2541
enabled: Boolean; whether this server is activated yet
2409
2542
interface: None or a network interface name (string)
2410
2543
use_ipv6: Boolean; to use IPv6 or not
2411
2544
"""
2412
2545
2413
2546
def __init__(self, server_address, RequestHandlerClass,
2414
2547
interface=None,
2415
2548
use_ipv6=True,
2425
2558
self.socketfd = socketfd
2426
2559
# Save the original socket.socket() function
2427
2560
self.socket_socket = socket.socket
2561
2428
2562
# To implement --socket, we monkey patch socket.socket.
2429
#
2563
#
2430
2564
# (When socketserver.TCPServer is a new-style class, we
2431
2565
# could make self.socket into a property instead of monkey
2432
2566
# patching socket.socket.)
2433
#
2567
#
2434
2568
# Create a one-time-only replacement for socket.socket()
2435
2569
@functools.wraps(socket.socket)
2436
2570
def socket_wrapper(*args, **kwargs):
2448
2582
# socket_wrapper(), if socketfd was set.
2449
2583
socketserver.TCPServer.__init__(self, server_address,
2450
2584
RequestHandlerClass)
2451
2585
2452
2586
def server_bind(self):
2453
2587
"""This overrides the normal server_bind() function
2454
2588
to bind to an interface if one was specified, and also NOT to
2479
2613
raise
2480
2614
# Only bind(2) the socket if we really need to.
2481
2615
if self.server_address[0] or self.server_address[1]:
2616
if self.server_address[1]:
2617
self.allow_reuse_address = True
2482
2618
if not self.server_address[0]:
2483
2619
if self.address_family == socket.AF_INET6:
2484
any_address = "::" # in6addr_any
2620
any_address = "::" # in6addr_any
2485
2621
else:
2486
any_address = "0.0.0.0" # INADDR_ANY
2622
any_address = "0.0.0.0" # INADDR_ANY
2487
2623
self.server_address = (any_address,
2488
2624
self.server_address[1])
2489
2625
elif not self.server_address[1]:
2499
2635
2500
2636
class MandosServer(IPv6_TCPServer):
2501
2637
"""Mandos server.
2502
2638
2503
2639
Attributes:
2504
2640
clients: set of Client objects
2505
2641
gnutls_priority GnuTLS priority string
2506
2642
use_dbus: Boolean; to emit D-Bus signals or not
2507
2643
2508
2644
Assumes a GLib.MainLoop event loop.
2509
2645
"""
2510
2646
2511
2647
def __init__(self, server_address, RequestHandlerClass,
2512
2648
interface=None,
2513
2649
use_ipv6=True,
2523
2659
self.gnutls_priority = gnutls_priority
2524
2660
IPv6_TCPServer.__init__(self, server_address,
2525
2661
RequestHandlerClass,
2526
interface = interface,
2527
use_ipv6 = use_ipv6,
2528
socketfd = socketfd)
2529
2662
interface=interface,
2663
use_ipv6=use_ipv6,
2664
socketfd=socketfd)
2665
2530
2666
def server_activate(self):
2531
2667
if self.enabled:
2532
2668
return socketserver.TCPServer.server_activate(self)
2533
2669
2534
2670
def enable(self):
2535
2671
self.enabled = True
2536
2672
2537
2673
def add_pipe(self, parent_pipe, proc):
2538
2674
# Call "handle_ipc" for both data and EOF events
2539
2675
GLib.io_add_watch(
2540
2676
parent_pipe.fileno(),
2541
2677
GLib.IO_IN | GLib.IO_HUP,
2542
2678
functools.partial(self.handle_ipc,
2543
parent_pipe = parent_pipe,
2544
proc = proc))
2545
2679
parent_pipe=parent_pipe,
2680
proc=proc))
2681
2546
2682
def handle_ipc(self, source, condition,
2547
2683
parent_pipe=None,
2548
proc = None,
2684
proc=None,
2549
2685
client_object=None):
2550
2686
# error, or the other end of multiprocessing.Pipe has closed
2551
2687
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2552
2688
# Wait for other process to exit
2553
2689
proc.join()
2554
2690
return False
2555
2691
2556
2692
# Read a request from the child
2557
2693
request = parent_pipe.recv()
2558
2694
command = request[0]
2559
2695
2560
2696
if command == 'init':
2561
fpr = request[1]
2562
address = request[2]
2563
2697
key_id = request[1].decode("ascii")
2698
fpr = request[2].decode("ascii")
2699
address = request[3]
2700
2564
2701
for c in self.clients.values():
2565
if c.fingerprint == fpr:
2702
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2703
continue
2704
if key_id and c.key_id == key_id:
2705
client = c
2706
break
2707
if fpr and c.fingerprint == fpr:
2566
2708
client = c
2567
2709
break
2568
2710
else:
2569
logger.info("Client not found for fingerprint: %s, ad"
2570
"dress: %s", fpr, address)
2711
logger.info("Client not found for key ID: %s, address"
2712
": %s", key_id or fpr, address)
2571
2713
if self.use_dbus:
2572
2714
# Emit D-Bus signal
2573
mandos_dbus_service.ClientNotFound(fpr,
2715
mandos_dbus_service.ClientNotFound(key_id or fpr,
2574
2716
address[0])
2575
2717
parent_pipe.send(False)
2576
2718
return False
2577
2719
2578
2720
GLib.io_add_watch(
2579
2721
parent_pipe.fileno(),
2580
2722
GLib.IO_IN | GLib.IO_HUP,
2581
2723
functools.partial(self.handle_ipc,
2582
parent_pipe = parent_pipe,
2583
proc = proc,
2584
client_object = client))
2724
parent_pipe=parent_pipe,
2725
proc=proc,
2726
client_object=client))
2585
2727
parent_pipe.send(True)
2586
2728
# remove the old hook in favor of the new above hook on
2587
2729
# same fileno
2590
2732
funcname = request[1]
2591
2733
args = request[2]
2592
2734
kwargs = request[3]
2593
2735
2594
2736
parent_pipe.send(('data', getattr(client_object,
2595
2737
funcname)(*args,
2596
2738
**kwargs)))
2597
2739
2598
2740
if command == 'getattr':
2599
2741
attrname = request[1]
2600
2742
if isinstance(client_object.__getattribute__(attrname),
2603
2745
else:
2604
2746
parent_pipe.send((
2605
2747
'data', client_object.__getattribute__(attrname)))
2606
2748
2607
2749
if command == 'setattr':
2608
2750
attrname = request[1]
2609
2751
value = request[2]
2610
2752
setattr(client_object, attrname, value)
2611
2753
2612
2754
return True
2613
2755
2614
2756
2615
2757
def rfc3339_duration_to_delta(duration):
2616
2758
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2617
2759
2618
2760
>>> rfc3339_duration_to_delta("P7D")
2619
2761
datetime.timedelta(7)
2620
2762
>>> rfc3339_duration_to_delta("PT60S")
2630
2772
>>> rfc3339_duration_to_delta("P1DT3M20S")
2631
2773
datetime.timedelta(1, 200)
2632
2774
"""
2633
2775
2634
2776
# Parsing an RFC 3339 duration with regular expressions is not
2635
2777
# possible - there would have to be multiple places for the same
2636
2778
# values, like seconds. The current code, while more esoteric, is
2637
2779
# cleaner without depending on a parsing library. If Python had a
2638
2780
# built-in library for parsing we would use it, but we'd like to
2639
2781
# avoid excessive use of external libraries.
2640
2782
2641
2783
# New type for defining tokens, syntax, and semantics all-in-one
2642
2784
Token = collections.namedtuple("Token", (
2643
2785
"regexp", # To match token; if "value" is not None, must have
2676
2818
frozenset((token_year, token_month,
2677
2819
token_day, token_time,
2678
2820
token_week)))
2679
# Define starting values
2680
value = datetime.timedelta() # Value so far
2821
# Define starting values:
2822
# Value so far
2823
value = datetime.timedelta()
2681
2824
found_token = None
2682
followers = frozenset((token_duration, )) # Following valid tokens
2683
s = duration # String left to parse
2825
# Following valid tokens
2826
followers = frozenset((token_duration, ))
2827
# String left to parse
2828
s = duration
2684
2829
# Loop until end token is found
2685
2830
while found_token is not token_end:
2686
2831
# Search for any currently valid tokens
2710
2855
2711
2856
def string_to_delta(interval):
2712
2857
"""Parse a string and return a datetime.timedelta
2713
2858
2714
2859
>>> string_to_delta('7d')
2715
2860
datetime.timedelta(7)
2716
2861
>>> string_to_delta('60s')
2724
2869
>>> string_to_delta('5m 30s')
2725
2870
datetime.timedelta(0, 330)
2726
2871
"""
2727
2872
2728
2873
try:
2729
2874
return rfc3339_duration_to_delta(interval)
2730
2875
except ValueError:
2731
2876
pass
2732
2877
2733
2878
timevalue = datetime.timedelta(0)
2734
2879
for s in interval.split():
2735
2880
try:
2753
2898
return timevalue
2754
2899
2755
2900
2756
def daemon(nochdir = False, noclose = False):
2901
def daemon(nochdir=False, noclose=False):
2757
2902
"""See daemon(3). Standard BSD Unix function.
2758
2903
2759
2904
This should really exist as os.daemon, but it doesn't (yet)."""
2760
2905
if os.fork():
2761
2906
sys.exit()
2779
2924
2780
2925
2781
2926
def main():
2782
2927
2783
2928
##################################################################
2784
2929
# Parsing of options, both command line and config file
2785
2930
2786
2931
parser = argparse.ArgumentParser()
2787
2932
parser.add_argument("-v", "--version", action="version",
2788
version = "%(prog)s {}".format(version),
2933
version="%(prog)s {}".format(version),
2789
2934
help="show version number and exit")
2790
2935
parser.add_argument("-i", "--interface", metavar="IF",
2791
2936
help="Bind to interface IF")
2827
2972
parser.add_argument("--no-zeroconf", action="store_false",
2828
2973
dest="zeroconf", help="Do not use Zeroconf",
2829
2974
default=None)
2830
2975
2831
2976
options = parser.parse_args()
2832
2977
2833
2978
if options.check:
2834
2979
import doctest
2835
2980
fail_count, test_count = doctest.testmod()
2836
2981
sys.exit(os.EX_OK if fail_count == 0 else 1)
2837
2982
2838
2983
# Default values for config file for server-global settings
2839
server_defaults = { "interface": "",
2840
"address": "",
2841
"port": "",
2842
"debug": "False",
2843
"priority":
2844
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2845
":+SIGN-DSA-SHA256",
2846
"servicename": "Mandos",
2847
"use_dbus": "True",
2848
"use_ipv6": "True",
2849
"debuglevel": "",
2850
"restore": "True",
2851
"socket": "",
2852
"statedir": "/var/lib/mandos",
2853
"foreground": "False",
2854
"zeroconf": "True",
2855
}
2856
2984
if gnutls.has_rawpk:
2985
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2986
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2987
else:
2988
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2989
":+SIGN-DSA-SHA256")
2990
server_defaults = {"interface": "",
2991
"address": "",
2992
"port": "",
2993
"debug": "False",
2994
"priority": priority,
2995
"servicename": "Mandos",
2996
"use_dbus": "True",
2997
"use_ipv6": "True",
2998
"debuglevel": "",
2999
"restore": "True",
3000
"socket": "",
3001
"statedir": "/var/lib/mandos",
3002
"foreground": "False",
3003
"zeroconf": "True",
3004
}
3005
del priority
3006
2857
3007
# Parse config file for server-global settings
2858
server_config = configparser.SafeConfigParser(server_defaults)
3008
server_config = configparser.ConfigParser(server_defaults)
2859
3009
del server_defaults
2860
3010
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2861
# Convert the SafeConfigParser object to a dict
3011
# Convert the ConfigParser object to a dict
2862
3012
server_settings = server_config.defaults()
2863
3013
# Use the appropriate methods on the non-string config options
2864
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3014
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3015
"foreground", "zeroconf"):
2865
3016
server_settings[option] = server_config.getboolean("DEFAULT",
2866
3017
option)
2867
3018
if server_settings["port"]:
2877
3028
server_settings["socket"] = os.dup(server_settings
2878
3029
["socket"])
2879
3030
del server_config
2880
3031
2881
3032
# Override the settings from the config file with command line
2882
3033
# options, if set.
2883
3034
for option in ("interface", "address", "port", "debug",
2901
3052
if server_settings["debug"]:
2902
3053
server_settings["foreground"] = True
2903
3054
# Now we have our good server settings in "server_settings"
2904
3055
2905
3056
##################################################################
2906
3057
2907
3058
if (not server_settings["zeroconf"]
2908
3059
and not (server_settings["port"]
2909
3060
or server_settings["socket"] != "")):
2910
3061
parser.error("Needs port or socket to work without Zeroconf")
2911
3062
2912
3063
# For convenience
2913
3064
debug = server_settings["debug"]
2914
3065
debuglevel = server_settings["debuglevel"]
2918
3069
stored_state_file)
2919
3070
foreground = server_settings["foreground"]
2920
3071
zeroconf = server_settings["zeroconf"]
2921
3072
2922
3073
if debug:
2923
3074
initlogger(debug, logging.DEBUG)
2924
3075
else:
2927
3078
else:
2928
3079
level = getattr(logging, debuglevel.upper())
2929
3080
initlogger(debug, level)
2930
3081
2931
3082
if server_settings["servicename"] != "Mandos":
2932
3083
syslogger.setFormatter(
2933
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
2934
3085
' %(levelname)s: %(message)s'.format(
2935
3086
server_settings["servicename"])))
2936
3087
2937
3088
# Parse config file with clients
2938
client_config = configparser.SafeConfigParser(Client
2939
.client_defaults)
3089
client_config = configparser.ConfigParser(Client.client_defaults)
2940
3090
client_config.read(os.path.join(server_settings["configdir"],
2941
3091
"clients.conf"))
2942
3092
2943
3093
global mandos_dbus_service
2944
3094
mandos_dbus_service = None
2945
3095
2946
3096
socketfd = None
2947
3097
if server_settings["socket"] != "":
2948
3098
socketfd = server_settings["socket"]
2964
3114
except IOError as e:
2965
3115
logger.error("Could not open file %r", pidfilename,
2966
3116
exc_info=e)
2967
3117
2968
3118
for name, group in (("_mandos", "_mandos"),
2969
3119
("mandos", "mandos"),
2970
3120
("nobody", "nogroup")):
2988
3138
.format(uid, gid, os.strerror(error.errno)))
2989
3139
if error.errno != errno.EPERM:
2990
3140
raise
2991
3141
2992
3142
if debug:
2993
3143
# Enable all possible GnuTLS debugging
2994
3144
2995
3145
# "Use a log level over 10 to enable all debugging options."
2996
3146
# - GnuTLS manual
2997
3147
gnutls.global_set_log_level(11)
2998
3148
2999
3149
@gnutls.log_func
3000
3150
def debug_gnutls(level, string):
3001
3151
logger.debug("GnuTLS: %s", string[:-1])
3002
3152
3003
3153
gnutls.global_set_log_function(debug_gnutls)
3004
3154
3005
3155
# Redirect stdin so all checkers get /dev/null
3006
3156
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3007
3157
os.dup2(null, sys.stdin.fileno())
3008
3158
if null > 2:
3009
3159
os.close(null)
3010
3160
3011
3161
# Need to fork before connecting to D-Bus
3012
3162
if not foreground:
3013
3163
# Close all input and output, do double fork, etc.
3014
3164
daemon()
3015
3016
# multiprocessing will use threads, so before we use GLib we need
3017
# to inform GLib that threads will be used.
3018
GLib.threads_init()
3019
3165
3166
if gi.version_info < (3, 10, 2):
3167
# multiprocessing will use threads, so before we use GLib we
3168
# need to inform GLib that threads will be used.
3169
GLib.threads_init()
3170
3020
3171
global main_loop
3021
3172
# From the Avahi example code
3022
3173
DBusGMainLoop(set_as_default=True)
3039
3190
if zeroconf:
3040
3191
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3041
3192
service = AvahiServiceToSyslog(
3042
name = server_settings["servicename"],
3043
servicetype = "_mandos._tcp",
3044
protocol = protocol,
3045
bus = bus)
3193
name=server_settings["servicename"],
3194
servicetype="_mandos._tcp",
3195
protocol=protocol,
3196
bus=bus)
3046
3197
if server_settings["interface"]:
3047
3198
service.interface = if_nametoindex(
3048
3199
server_settings["interface"].encode("utf-8"))
3049
3200
3050
3201
global multiprocessing_manager
3051
3202
multiprocessing_manager = multiprocessing.Manager()
3052
3203
3053
3204
client_class = Client
3054
3205
if use_dbus:
3055
client_class = functools.partial(ClientDBus, bus = bus)
3056
3206
client_class = functools.partial(ClientDBus, bus=bus)
3207
3057
3208
client_settings = Client.config_parser(client_config)
3058
3209
old_client_settings = {}
3059
3210
clients_data = {}
3060
3211
3061
3212
# This is used to redirect stdout and stderr for checker processes
3062
3213
global wnull
3063
wnull = open(os.devnull, "w") # A writable /dev/null
3214
wnull = open(os.devnull, "w") # A writable /dev/null
3064
3215
# Only used if server is running in foreground but not in debug
3065
3216
# mode
3066
3217
if debug or not foreground:
3067
3218
wnull.close()
3068
3219
3069
3220
# Get client data and settings from last running state.
3070
3221
if server_settings["restore"]:
3071
3222
try:
3072
3223
with open(stored_state_path, "rb") as stored_state:
3073
if sys.version_info.major == 2:
3224
if sys.version_info.major == 2:
3074
3225
clients_data, old_client_settings = pickle.load(
3075
3226
stored_state)
3076
3227
else:
3077
3228
bytes_clients_data, bytes_old_client_settings = (
3078
pickle.load(stored_state, encoding = "bytes"))
3079
### Fix bytes to strings
3080
## clients_data
3229
pickle.load(stored_state, encoding="bytes"))
3230
# Fix bytes to strings
3231
# clients_data
3081
3232
# .keys()
3082
clients_data = { (key.decode("utf-8")
3083
if isinstance(key, bytes)
3084
else key): value
3085
for key, value in
3086
bytes_clients_data.items() }
3233
clients_data = {(key.decode("utf-8")
3234
if isinstance(key, bytes)
3235
else key): value
3236
for key, value in
3237
bytes_clients_data.items()}
3087
3238
del bytes_clients_data
3088
3239
for key in clients_data:
3089
value = { (k.decode("utf-8")
3090
if isinstance(k, bytes) else k): v
3091
for k, v in
3092
clients_data[key].items() }
3240
value = {(k.decode("utf-8")
3241
if isinstance(k, bytes) else k): v
3242
for k, v in
3243
clients_data[key].items()}
3093
3244
clients_data[key] = value
3094
3245
# .client_structure
3095
3246
value["client_structure"] = [
3096
3247
(s.decode("utf-8")
3097
3248
if isinstance(s, bytes)
3098
3249
else s) for s in
3099
value["client_structure"] ]
3250
value["client_structure"]]
3100
3251
# .name & .host
3101
3252
for k in ("name", "host"):
3102
3253
if isinstance(value[k], bytes):
3103
3254
value[k] = value[k].decode("utf-8")
3104
## old_client_settings
3255
if "key_id" not in value:
3256
value["key_id"] = ""
3257
elif "fingerprint" not in value:
3258
value["fingerprint"] = ""
3259
# old_client_settings
3105
3260
# .keys()
3106
3261
old_client_settings = {
3107
3262
(key.decode("utf-8")
3108
3263
if isinstance(key, bytes)
3109
3264
else key): value
3110
3265
for key, value in
3111
bytes_old_client_settings.items() }
3266
bytes_old_client_settings.items()}
3112
3267
del bytes_old_client_settings
3113
3268
# .host
3114
3269
for value in old_client_settings.values():
3128
3283
logger.warning("Could not load persistent state: "
3129
3284
"EOFError:",
3130
3285
exc_info=e)
3131
3286
3132
3287
with PGPEngine() as pgp:
3133
3288
for client_name, client in clients_data.items():
3134
3289
# Skip removed clients
3135
3290
if client_name not in client_settings:
3136
3291
continue
3137
3292
3138
3293
# Decide which value to use after restoring saved state.
3139
3294
# We have three different values: Old config file,
3140
3295
# new config file, and saved state.
3151
3306
client[name] = value
3152
3307
except KeyError:
3153
3308
pass
3154
3309
3155
3310
# Clients who has passed its expire date can still be
3156
3311
# enabled if its last checker was successful. A Client
3157
3312
# whose checker succeeded before we stored its state is
3190
3345
client_name))
3191
3346
client["secret"] = (client_settings[client_name]
3192
3347
["secret"])
3193
3348
3194
3349
# Add/remove clients based on new changes made to config
3195
3350
for client_name in (set(old_client_settings)
3196
3351
- set(client_settings)):
3198
3353
for client_name in (set(client_settings)
3199
3354
- set(old_client_settings)):
3200
3355
clients_data[client_name] = client_settings[client_name]
3201
3356
3202
3357
# Create all client objects
3203
3358
for client_name, client in clients_data.items():
3204
3359
tcp_server.clients[client_name] = client_class(
3205
name = client_name,
3206
settings = client,
3207
server_settings = server_settings)
3208
3360
name=client_name,
3361
settings=client,
3362
server_settings=server_settings)
3363
3209
3364
if not tcp_server.clients:
3210
3365
logger.warning("No clients defined")
3211
3366
3212
3367
if not foreground:
3213
3368
if pidfile is not None:
3214
3369
pid = os.getpid()
3220
3375
pidfilename, pid)
3221
3376
del pidfile
3222
3377
del pidfilename
3223
3378
3224
3379
for termsig in (signal.SIGHUP, signal.SIGTERM):
3225
3380
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3226
3381
lambda: main_loop.quit() and False)
3227
3382
3228
3383
if use_dbus:
3229
3384
3230
3385
@alternate_dbus_interfaces(
3231
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3386
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3232
3387
class MandosDBusService(DBusObjectWithObjectManager):
3233
3388
"""A D-Bus proxy object"""
3234
3389
3235
3390
def __init__(self):
3236
3391
dbus.service.Object.__init__(self, bus, "/")
3237
3392
3238
3393
_interface = "se.recompile.Mandos"
3239
3394
3240
3395
@dbus.service.signal(_interface, signature="o")
3241
3396
def ClientAdded(self, objpath):
3242
3397
"D-Bus signal"
3243
3398
pass
3244
3399
3245
3400
@dbus.service.signal(_interface, signature="ss")
3246
def ClientNotFound(self, fingerprint, address):
3401
def ClientNotFound(self, key_id, address):
3247
3402
"D-Bus signal"
3248
3403
pass
3249
3404
3250
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3251
3406
"true"})
3252
3407
@dbus.service.signal(_interface, signature="os")
3253
3408
def ClientRemoved(self, objpath, name):
3254
3409
"D-Bus signal"
3255
3410
pass
3256
3411
3257
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3258
3413
"true"})
3259
3414
@dbus.service.method(_interface, out_signature="ao")
3261
3416
"D-Bus method"
3262
3417
return dbus.Array(c.dbus_object_path for c in
3263
3418
tcp_server.clients.values())
3264
3419
3265
3420
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3266
3421
"true"})
3267
3422
@dbus.service.method(_interface,
3269
3424
def GetAllClientsWithProperties(self):
3270
3425
"D-Bus method"
3271
3426
return dbus.Dictionary(
3272
{ c.dbus_object_path: c.GetAll(
3427
{c.dbus_object_path: c.GetAll(
3273
3428
"se.recompile.Mandos.Client")
3274
for c in tcp_server.clients.values() },
3429
for c in tcp_server.clients.values()},
3275
3430
signature="oa{sv}")
3276
3431
3277
3432
@dbus.service.method(_interface, in_signature="o")
3278
3433
def RemoveClient(self, object_path):
3279
3434
"D-Bus method"
3287
3442
self.client_removed_signal(c)
3288
3443
return
3289
3444
raise KeyError(object_path)
3290
3445
3291
3446
del _interface
3292
3447
3293
3448
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3294
out_signature = "a{oa{sa{sv}}}")
3449
out_signature="a{oa{sa{sv}}}")
3295
3450
def GetManagedObjects(self):
3296
3451
"""D-Bus method"""
3297
3452
return dbus.Dictionary(
3298
{ client.dbus_object_path:
3299
dbus.Dictionary(
3300
{ interface: client.GetAll(interface)
3301
for interface in
3302
client._get_all_interface_names()})
3303
for client in tcp_server.clients.values()})
3304
3453
{client.dbus_object_path:
3454
dbus.Dictionary(
3455
{interface: client.GetAll(interface)
3456
for interface in
3457
client._get_all_interface_names()})
3458
for client in tcp_server.clients.values()})
3459
3305
3460
def client_added_signal(self, client):
3306
3461
"""Send the new standard signal and the old signal"""
3307
3462
if use_dbus:
3309
3464
self.InterfacesAdded(
3310
3465
client.dbus_object_path,
3311
3466
dbus.Dictionary(
3312
{ interface: client.GetAll(interface)
3313
for interface in
3314
client._get_all_interface_names()}))
3467
{interface: client.GetAll(interface)
3468
for interface in
3469
client._get_all_interface_names()}))
3315
3470
# Old signal
3316
3471
self.ClientAdded(client.dbus_object_path)
3317
3472
3318
3473
def client_removed_signal(self, client):
3319
3474
"""Send the new standard signal and the old signal"""
3320
3475
if use_dbus:
3325
3480
# Old signal
3326
3481
self.ClientRemoved(client.dbus_object_path,
3327
3482
client.name)
3328
3483
3329
3484
mandos_dbus_service = MandosDBusService()
3330
3485
3331
3486
# Save modules to variables to exempt the modules from being
3332
3487
# unloaded before the function registered with atexit() is run.
3333
3488
mp = multiprocessing
3334
3489
wn = wnull
3490
3335
3491
def cleanup():
3336
3492
"Cleanup function; run on exit"
3337
3493
if zeroconf:
3338
3494
service.cleanup()
3339
3495
3340
3496
mp.active_children()
3341
3497
wn.close()
3342
3498
if not (tcp_server.clients or client_settings):
3343
3499
return
3344
3500
3345
3501
# Store client before exiting. Secrets are encrypted with key
3346
3502
# based on what config file has. If config file is
3347
3503
# removed/edited, old secret will thus be unrecovable.
3352
3508
client.encrypted_secret = pgp.encrypt(client.secret,
3353
3509
key)
3354
3510
client_dict = {}
3355
3511
3356
3512
# A list of attributes that can not be pickled
3357
3513
# + secret.
3358
exclude = { "bus", "changedstate", "secret",
3359
"checker", "server_settings" }
3514
exclude = {"bus", "changedstate", "secret",
3515
"checker", "server_settings"}
3360
3516
for name, typ in inspect.getmembers(dbus.service
3361
3517
.Object):
3362
3518
exclude.add(name)
3363
3519
3364
3520
client_dict["encrypted_secret"] = (client
3365
3521
.encrypted_secret)
3366
3522
for attr in client.client_structure:
3367
3523
if attr not in exclude:
3368
3524
client_dict[attr] = getattr(client, attr)
3369
3525
3370
3526
clients[client.name] = client_dict
3371
3527
del client_settings[client.name]["secret"]
3372
3528
3373
3529
try:
3374
3530
with tempfile.NamedTemporaryFile(
3375
3531
mode='wb',
3378
3534
dir=os.path.dirname(stored_state_path),
3379
3535
delete=False) as stored_state:
3380
3536
pickle.dump((clients, client_settings), stored_state,
3381
protocol = 2)
3537
protocol=2)
3382
3538
tempname = stored_state.name
3383
3539
os.rename(tempname, stored_state_path)
3384
3540
except (IOError, OSError) as e:
3394
3550
logger.warning("Could not save persistent state:",
3395
3551
exc_info=e)
3396
3552
raise
3397
3553
3398
3554
# Delete all clients, and settings from config
3399
3555
while tcp_server.clients:
3400
3556
name, client = tcp_server.clients.popitem()
3406
3562
if use_dbus:
3407
3563
mandos_dbus_service.client_removed_signal(client)
3408
3564
client_settings.clear()
3409
3565
3410
3566
atexit.register(cleanup)
3411
3567
3412
3568
for client in tcp_server.clients.values():
3413
3569
if use_dbus:
3414
3570
# Emit D-Bus signal for adding
3416
3572
# Need to initiate checking of clients
3417
3573
if client.enabled:
3418
3574
client.init_checker()
3419
3575
3420
3576
tcp_server.enable()
3421
3577
tcp_server.server_activate()
3422
3578
3423
3579
# Find out what port we got
3424
3580
if zeroconf:
3425
3581
service.port = tcp_server.socket.getsockname()[1]
3430
3586
else: # IPv4
3431
3587
logger.info("Now listening on address %r, port %d",
3432
3588
*tcp_server.socket.getsockname())
3433
3434
#service.interface = tcp_server.socket.getsockname()[3]
3435
3589
3590
# service.interface = tcp_server.socket.getsockname()[3]
3591
3436
3592
try:
3437
3593
if zeroconf:
3438
3594
# From the Avahi example code
3443
3599
cleanup()
3444
3600
sys.exit(1)
3445
3601
# End of Avahi example code
3446
3602
3447
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3448
3604
lambda *args, **kwargs:
3449
3605
(tcp_server.handle_request
3450
3606
(*args[2:], **kwargs) or True))
3451
3607
3452
3608
logger.debug("Starting main loop")
3453
3609
main_loop.run()
3454
3610
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0